question

LVThyDng-1512 avatar image
0 Votes"
LVThyDng-1512 asked LVThyDng-1512 commented

Create multiple tunnels between a VNet and an on-premises site with automatic failover

We are currently using a site-to-site VPN connection between Azure and my on-premiese VPN. We want to create one more site-to-site VPN connection between them, how can between tunnels have automatic failover when a tunnel is disconnected. Is it possible to use static route or can only use BGP?

azure-vpn-gateway
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

AndriyBilous avatar image
1 Vote"
AndriyBilous answered LVThyDng-1512 commented

Hello @LVThyDng-1512

Every Azure VPN gateway consists of two instances in an active-standby configuration. For any planned maintenance or unplanned disruption that happens to the active instance, the standby instance would take over (failover) automatically, and resume the S2S VPN connection.

137724-image.png

To provide better availability for your cross premises connections you can create an Azure VPN gateway in an active-active configuration, where both instances of the gateway VMs will establish S2S VPN tunnels to your on-premises VPN device, as shown the following diagram:
In this configuration, each Azure gateway instance will have a unique public IP address, and each will establish an IPsec/IKE S2S VPN tunnel to your on-premises VPN device specified in your local network gateway and connection.

137725-image.png

Azure VPN Gateway support multiple tunnels between a VNet and an on-premises site with automatic failover based on BGP
This capability provides multiple tunnels (paths) between the two networks in an active-active configuration.
137783-image.png

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-bgp-overview



image.png (27.6 KiB)
image.png (29.5 KiB)
image.png (13.8 KiB)
· 5
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @AndriyBilous

Our on premise VPN is currently using a static route, is there any way I can continue to use a static route for the second tunnel between them. If one of the tunnels is disconnected, the traffic automatically shifts to the remaining tunnels.
Can we use active-active configuration for this case?

0 Votes 0 ·

In Active-active configuration you will need to configure your on-premises VPN device to accept or establish two S2S VPN tunnels to those two Azure VPN gateway public IP addresses.
As Azure gateway instances are in active-active configuration, the traffic from your Azure virtual network to your on-premises network will be routed through both tunnels simultaneously, even if your on-premises VPN device may favor one tunnel over the other. For a single TCP or UDP flow, Azure attempts to use the same tunnel when sending packets to your on-premises network. However, your on-premises network could use a different tunnel to send packets to Azure.

0 Votes 0 ·

Hi @AndriyBilous

As far as I understand:
"If I just want to create an Azure VPN gateway in an active-active configuration, where both instances of the gateway VMs will establish S2S VPN tunnels to my single on-premises VPN device, BGP is not required for this configuration.
For this configuration, I just have to keep the Enable active-active mode: Enabled in my VPN gateway.
The active-active mode is available for all SKUs except Basic."

1) BGP is not required for this configuration. => What routing protocol can I use, can I use static route?
2) If using a static route, when one of the tunnels is disconnected, will traffic automatically shifts to the remaining tunnels?

0 Votes 0 ·
Show more comments